Web Application Firewalls: Panel Discussion Sebastien Deleersnyder CISSP Feb, 2006 sdl@ascure.com

Agenda Panel Introduction WAF Primer Panel Discussion

Agenda Panel Introduction WAF Primer Panel Discussion

Panel Introduction Philippe Bogaerts, BeeWare Jaak Cuppens, F5 Networks Tim Groenwals, Agfa Gevaert Lieven Desmet, K.U.Leuven David Van der Linden, ING present yourself shortly + how do you or your organisation use the Top 10 ?

Agenda Introduction WAF Primer Panel Discussion

Network Firewalls Do Not Work Application Database Server Web Client Web Server Application HTTP(S) Traffic Port 80 (443)

Enter Web Application Firewall Era HW/SW that mitigates web application vulnerabilities: Invalidated Input Parameter tampering Injection Flaws …

Web Application Firewalls They understand HTTP/HTML very well They work after traffic is decrypted, or can otherwise terminate SSL Prevention is possible

Topologies Network-based: Web server-based: Protects any web server Works with many servers at once Web server-based: Closer to the application Limited by the web server API

WAF functionality Rule-based: Anomaly-based: Uses rules to look for known vulnerabilities Or rules to look for classes of attack Rely on rule databases Anomaly-based: Attempts to figure out what normal operation means

WAF Protection Strategies Negative security model: Deny what might be dangerous. Do you always know what is dangerous? Positive security model: Allow what is known to be safe. Positive security model is better.

Vendors MOD-Security Beeware IntelliWall Citrix NetScaler Application Firewall (Teros) DenyAll rWeb F5 TrafficShield (Magnifire) Imperva SecureSphere Netcontinuum Breach BreachGate WebDefend … eEye SecureIIS Microsoft URLScan WAF? CheckPoint Application Intelligence? MS ISA Server? Dead: Kavado InterDo Watchfire AppShield (Sanctum) Ubizen DMZShield

Agenda Introduction WAF Primer Panel Discussion

How mature are WAFs? What are the 5 phases of a Hype Cycle? 1. "Technology Trigger" The first phase of a Hype Cycle is the "technology trigger" or breakthrough, product launch or other event that generates significant press and interest. 2. "Peak of Inflated Expectations" In the next phase, a frenzy of publicity typically generates over-enthusiasm and unrealistic expectations. There may be some successful applications of a technology, but there are typically more failures. 3. "Trough of Disillusionment" Technologies enter the "trough of disillusionment" because they fail to meet expectations and quickly become unfashionable. Consequently, the press usually abandons the topic and the technology. 4. "Slope of Enlightenment" Although the press may have stopped covering the technology, some businesses continue through the "slope of enlightenment" and experiment to understand the benefits and practical application of the technology. 5. "Plateau of Productivity" A technology reaches the "plateau of productivity" as the benefits of it become widely demonstrated and accepted. The technology becomes increasingly stable and evolves in second and third generations. The final height of the plateau varies according to whether the technology is broadly applicable or benefits only a niche market.

What do WAFs protect you from? What not? Panel Discussion What do WAFs protect you from? What not? Where do you position WAFs in your architecture? What WAF functionality do you really need? How to reduce TCO? Who administrates a WAF within the organisation?